{"ok":true,"data":{"evidence_id":"ev_21c2693d6ba4f1df2a06a49089c05c3c2dba713ccf896886d59605cfac287a74","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1839888f0;pdgo @ 0x1839888f0;afij @ 0x1839888f0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1839888f0;pdgo @ 0x1839888f0;afij @ 0x1839888f0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1839888f0    |int64_t fcn.1839888f0(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    undefined8 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    \r\n    0x1839888fe    |    puVar4 = (undefined8 *)fcn.185f006b8(0x378);\r\n    0x183988909    |    fcn.188ac3fa0();\r\n    0x183988913    |    *(undefined4 *)(puVar4 + 0x45) = 0xffffffff;\r\n    0x18398891c    |    *(undefined8 *)((int64_t)puVar4 + 0x22c) = 0;\r\n    0x18398891c    |    *(undefined8 *)((int64_t)puVar4 + 0x234) = 0;\r\n    0x183988923    |    *(undefined8 *)((int64_t)puVar4 + 0x23c) = 0;\r\n    0x183988923    |    *(undefined8 *)((int64_t)puVar4 + 0x244) = 0;\r\n    0x18398892a    |    *(undefined8 *)((int64_t)puVar4 + 0x24c) = 0;\r\n    0x18398892a    |    *(undefined8 *)((int64_t)puVar4 + 0x254) = 0;\r\n    0x183988931    |    *(undefined *)((int64_t)puVar4 + 0x25c) = 0;\r\n    0x183988938    |    puVar4[0x4c] = 0;\r\n    0x183988938    |    puVar4[0x4d] = 0;\r\n    0x18398893f    |    puVar4[0x4e] = 0;\r\n    0x18398893f    |    puVar4[0x4f] = 0;\r\n    0x183988946    |    puVar4[0x50] = 0;\r\n    0x183988946    |    puVar4[0x51] = 0;\r\n    0x18398894d    |    puVar4[0x52] = 0;\r\n    0x18398894d    |    puVar4[0x53] = 0;\r\n    0x183988954    |    puVar4[0x54] = 0;\r\n    0x183988954    |    puVar4[0x55] = 0;\r\n    0x18398895d    |    puVar4[0x56] = 0;\r\n    0x183988964    |    puVar4[0x58] = 0;\r\n    0x183988964    |    puVar4[0x59] = 0;\r\n    0x18398896b    |    puVar4[0x5a] = 0;\r\n    0x183988972    |    *(undefined4 *)(puVar4 + 0x5b) = 0xffffffff;\r\n    0x183988978    |    puVar4[0x5c] = 0;\r\n    0x183988978    |    puVar4[0x5d] = 0;\r\n    0x18398897f    |    puVar4[0x5e] = 0;\r\n    0x18398897f    |    puVar4[0x5f] = 0;\r\n    0x183988986    |    puVar4[0x60] = 0;\r\n    0x183988986    |    puVar4[0x61] = 0;\r\n    0x183988994    |    puVar4[0x57] = 0x18feffbd8;\r\n    0x18398899b    |    puVar4[0x62] = 0;\r\n    0x1839889a2    |    puVar4[0x66] = 0;\r\n    0x1839889a9    |    puVar4[100] = 0;\r\n    0x1839889a9    |    puVar4[0x65] = 0;\r\n    0x1839889b0    |    *(undefined4 *)(puVar4 + 0x67) = 0xffffffff;\r\n    0x1839889b6    |    puVar4[0x68] = 0;\r\n    0x1839889b6    |    puVar4[0x69] = 0;\r\n    0x1839889bd    |    puVar4[0x6a] = 0;\r\n    0x1839889bd    |    puVar4[0x6b] = 0;\r\n    0x1839889c4    |    puVar4[0x6c] = 0;\r\n    0x1839889c4    |    puVar4[0x6d] = 0;\r\n    0x1839889cb    |    puVar4[99] = 0x18feffbd8;\r\n    0x1839889d2    |    puVar4[0x6e] = 0;\r\n    0x1839889e0    |    *puVar4 = 0x19006ef68;\r\n    0x1839889e6    |    if (puVar4 != (undefined8 *)0x0) {\r\n    0x1839889ed    |        LOCK();\r\n    0x1839889ed    |        piVar1 = (int32_t *)(puVar4 + 1);\r\n    0x1839889ed    |        iVar2 = *piVar1;\r\n    0x1839889ed    |        *piVar1 = *piVar1 + 1;\r\n    0x1839889ed    |        UNLOCK();\r\n    0x1839889f7    |        if (iVar2 == 0x7fffffff) {\r\n    0x183988a06    |            pcVar3 = (code *)swi(3);\r\n    0x183988a06    |            iVar5 = (*pcVar3)();\r\n    0x183988a06    |            return iVar5;\r\n                   |        }\r\n                   |    }\r\n    0x1839889f9    |    *(undefined8 **)arg1 = puVar4;\r\n    0x183988a05    |    return arg1;\r\n                   |}\r\n[{\"offset\":6502779120,\"name\":\"fcn.1839888f0\",\"size\":279,\"is-pure\":false,\"realsz\":279,\"noreturn\":false,\"stackframe\":56,\"calltype\":\"ms\",\"cost\":63,\"cc\":4,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":4,\"edges\":4,\"ebbs\":2,\"signature\":\"fcn.1839888f0(int64_t arg1);\",\"minbound\":6502779120,\"maxbound\":6502779399,\"callrefs\":[{\"from\":6502779134,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6502779145,\"to\":6587957152,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6502779277,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6502779353,\"to\":6711340904,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":2,\"nlocals\":0,\"nargs\":1,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1839888f0    |int64_t fcn.1839888f0(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    undefined8 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    \r\n    0x1839888fe    |    puVar4 = (undefined8 *)fcn.185f006b8(0x378);\r\n    0x183988909    |    fcn.188ac3fa0();\r\n    0x183988913    |    *(undefined4 *)(puVar4 + 0x45) = 0xffffffff;\r\n    0x18398891c    |    *(undefined8 *)((int64_t)puVar4 + 0x22c) = 0;\r\n    0x18398891c    |    *(undefined8 *)((int64_t)puVar4 + 0x234) = 0;\r\n    0x183988923    |    *(undefined8 *)((int64_t)puVar4 + 0x23c) = 0;\r\n    0x183988923    |    *(undefined8 *)((int64_t)puVar4 + 0x244) = 0;\r\n    0x18398892a    |    *(undefined8 *)((int64_t)puVar4 + 0x24c) = 0;\r\n    0x18398892a    |    *(undefined8 *)((int64_t)puVar4 + 0x254) = 0;\r\n    0x183988931    |    *(undefined *)((int64_t)puVar4 + 0x25c) = 0;\r\n    0x183988938    |    puVar4[0x4c] = 0;\r\n    0x183988938    |    puVar4[0x4d] = 0;\r\n    0x18398893f    |    puVar4[0x4e] = 0;\r\n    0x18398893f    |    puVar4[0x4f] = 0;\r\n    0x183988946    |    puVar4[0x50] = 0;\r\n    0x183988946    |    puVar4[0x51] = 0;\r\n    0x18398894d    |    puVar4[0x52] = 0;\r\n    0x18398894d    |    puVar4[0x53] = 0;\r\n    0x183988954    |    puVar4[0x54] = 0;\r\n    0x183988954    |    puVar4[0x55] = 0;\r\n    0x18398895d    |    puVar4[0x56] = 0;\r\n    0x183988964    |    puVar4[0x58] = 0;\r\n    0x183988964    |    puVar4[0x59] = 0;\r\n    0x18398896b    |    puVar4[0x5a] = 0;\r\n    0x183988972    |    *(undefined4 *)(puVar4 + 0x5b) = 0xffffffff;\r\n    0x183988978    |    puVar4[0x5c] = 0;\r\n    0x183988978    |    puVar4[0x5d] = 0;\r\n    0x18398897f    |    puVar4[0x5e] = 0;\r\n    0x18398897f    |    puVar4[0x5f] = 0;\r\n    0x183988986    |    puVar4[0x60] = 0;\r\n    0x183988986    |    puVar4[0x61] = 0;\r\n    0x183988994    |    puVar4[0x57] = 0x18feffbd8;\r\n    0x18398899b    |    puVar4[0x62] = 0;\r\n    0x1839889a2    |    puVar4[0x66] = 0;\r\n    0x1839889a9    |    puVar4[100] = 0;\r\n    0x1839889a9    |    puVar4[0x65] = 0;\r\n    0x1839889b0    |    *(undefined4 *)(puVar4 + 0x67) = 0xffffffff;\r\n    0x1839889b6    |    puVar4[0x68] = 0;\r\n    0x1839889b6    |    puVar4[0x69] = 0;\r\n    0x1839889bd    |    puVar4[0x6a] = 0;\r\n    0x1839889bd    |    puVar4[0x6b] = 0;\r\n    0x1839889c4    |    puVar4[0x6c] = 0;\r\n    0x1839889c4    |    puVar4[0x6d] = 0;\r\n    0x1839889cb    |    puVar4[99] = 0x18feffbd8;\r\n    0x1839889d2    |    puVar4[0x6e] = 0;\r\n    0x1839889e0    |    *puVar4 = 0x19006ef68;\r\n    0x1839889e6    |    if (puVar4 != (undefined8 *)0x0) {\r\n    0x1839889ed    |        LOCK();\r\n    0x1839889ed    |        piVar1 = (int32_t *)(puVar4 + 1);\r\n    0x1839889ed    |        iVar2 = *piVar1;\r\n    0x1839889ed    |        *piVar1 = *piVar1 + 1;\r\n    0x1839889ed    |        UNLOCK();\r\n    0x1839889f7    |        if (iVar2 == 0x7fffffff) {\r\n    0x183988a06    |            pcVar3 = (code *)swi(3);\r\n    0x183988a06    |            iVar5 = (*pcVar3)();\r\n    0x183988a06    |            return iVar5;\r\n                   |        }\r\n                   |    }\r\n    0x1839889f9    |    *(undefined8 **)arg1 = puVar4;\r\n    0x183988a05    |    return arg1;\r\n                   |}\r\n[{\"offset\":6502779120,\"name\":\"fcn.1839888f0\",\"size\":279,\"is-pure\":false,\"realsz\":279,\"noreturn\":false,\"stackframe\":56,\"calltype\":\"ms\",\"cost\":63,\"cc\":4,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":4,\"edges\":4,\"ebbs\":2,\"signature\":\"fcn.1839888f0(int64_t arg1);\",\"minbound\":6502779120,\"maxbound\":6502779399,\"callrefs\":[{\"from\":6502779134,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6502779145,\"to\":6587957152,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6502779277,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6502779353,\"to\":6711340904,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":2,\"nlocals\":0,\"nargs\":1,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5004ms"}}